Wireshark · Wireshark-dev: Re: [Wireshark-dev] Is it possible to add the actual data (80 bytes) to the proto tree in a chunk?

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

How about feeding the data to the data dissector?
Create a sub_tvb from the current offset to the end of the frame (assuming
the data is at the end) and hand that to the data dissector. Lots of
samples in other dissectors.

Thanx,
Jaap

On Thu, 21 Sep 2006, Bill Fassler wrote:

> Ya know how the first branch of the plugin tree highlights the entire packet, the header, data and everything? Well, my superiors (who is everybody in the world it seems) insist that I add a final branch that highlights the actual data packet (in this case -  an 80 byte audio packet).  Everything I have tried throws a failed assertion.
>
> Here is the last working branch:
> proto_tree_add_item(vppn_tree, hf_channel_data, tvb, offset, 2, FALSE);
>
> Here is a few of the many worthless things I've tried: (I do not declare hf_audio_data in the protocol field array)
>
> proto_tree_add_item(vppn_tree, hf_audio_data, tvb, offset, 80, FALSE);
> and
> proto_tree_add_item(vppn_tree, hf_audio_data, tvb, offset, -1, FALSE);
> and
> ti = proto_tree_add_item(audio_tree, hf_audio_data, tvb, 0, -1, FALSE);
>
> I know this is crazy since there is no need to dissect this, but for cosmetic reasons I have been asked to implement it.  Can any of you Gurus sell me some smoke and mirrors or maybe some pixie dust before I climb the clock tower with my sling shot?
>
> BIll
>
>
> ---------------------------------
> Stay in the know. Pulse on the new Yahoo.com.  Check it out.